diff --git a/Makefile b/Makefile
index 5f395db56..fff083dd0 100644
--- a/Makefile
+++ b/Makefile
@@ -121,8 +121,10 @@ docker-image_DOCKERFILE:=Dockerfile
 # need to be called from the root of the repo.
 kubeval-validator_IS_INDEPENDED:=true
 clusterctl_IS_INDEPENDED:=true
+clusterctl-v0.3_IS_INDEPENDED:=true
 toolbox-virsh_IS_INDEPENDED:=true
 # in addition toolbox-virsh docker image needs toolbox docker image to be built first
+docker-image-clusterctl-v0.3_DEPENDENCY:=docker-image-clusterctl
 docker-image-toolbox-virsh_DEPENDENCY:=docker-image-toolbox
 
 # The template that generates targets for creating binaries per component:
@@ -133,10 +135,10 @@ docker-image-toolbox-virsh_DEPENDENCY:=docker-image-toolbox
 # When template is rendered all $ will be rendered in the template and $$ will be converted to $, e.g.
 # if we call map_binary_defaults_tmpl for airshipctl $1 will be converted to 'airshipctl' and we'll get
 # ifneq ($(airshipctl_IS_INDEPENDED),true)
-# arishipctl_FROM_PATH?=$(BIN_SRC_DIR)/airshipctl/main.go
+# airshipctl_FROM_PATH?=$(BIN_SRC_DIR)/airshipctl/main.go
 # ...
-# since we defining arishipctl_FROM_PATH above, and ?= is used in the 2nd line
-# arishipctl_FROM_PATH will stay the same as it was defined above.
+# since we defining airshipctl_FROM_PATH above, and ?= is used in the 2nd line
+# airshipctl_FROM_PATH will stay the same as it was defined above.
 define map_binary_defaults_tmpl
 ifneq ($$($1_IS_INDEPENDED),true)
 $1_FROM_PATH?=$$(BIN_SRC_DIR)/$1/main.go
@@ -166,6 +168,8 @@ $(foreach bin,$(BINS),$(call map_binary_defaults,$(bin)))
 define map_image_defaults_tmpl
 $1_IMG_TGT_NAME?=docker-image-$1
 
+$$($1_IMG_TGT_NAME)_IMG_TITLE?=$1
+$$($1_IMG_TGT_NAME)_IMG_TAG?=$$(DOCKER_IMAGE_TAG)
 $$($1_IMG_TGT_NAME)_DOCKERTGT?=$$(DOCKER_TARGET_STAGE)
 $$($1_IMG_TGT_NAME)_DOCKERFILE?=$$(BIN_SRC_DIR)/$1/Dockerfile
 $$($1_IMG_TGT_NAME)_MAKETGT?=$$(BIN_DIR)/$1
@@ -206,6 +210,11 @@ ifneq ($$(strip $$($$($1_IMG_TGT_NAME)_BASE_RELEASE_IMAGE)),)
 $$($1_IMG_TGT_NAME)_BUILD_ARG  += RELEASE_IMAGE=$$($$($1_IMG_TGT_NAME)_BASE_RELEASE_IMAGE)
 endif
 
+ifeq ($1,clusterctl-v0.3)
+$$($1_IMG_TGT_NAME)_IMG_TAG=v0.3
+$$($1_IMG_TGT_NAME)_IMG_TITLE=clusterctl
+endif
+
 $$(warning Adding dynamic target $$($1_IMG_TGT_NAME))
 .PHONY: $$($1_IMG_TGT_NAME)
 $$($1_IMG_TGT_NAME): $$($$($1_IMG_TGT_NAME)_DEPENDENCY)
@@ -214,14 +223,14 @@ $$($1_IMG_TGT_NAME): $$($$($1_IMG_TGT_NAME)_DEPENDENCY)
 		--label $$(LABEL) \
 		--label "org.opencontainers.image.revision=$$(COMMIT)" \
 		--label "org.opencontainers.image.created=$$(shell date --rfc-3339=seconds --utc)" \
-		--label "org.opencontainers.image.title=$1" \
+		--label "org.opencontainers.image.title=$$($$($1_IMG_TGT_NAME)_IMG_TITLE)" \
 		--target $$($$($1_IMG_TGT_NAME)_DOCKERTGT) \
 		$$(addprefix --build-arg ,$$($$($1_IMG_TGT_NAME)_BUILD_ARG)) \
 		--build-arg MAKE_TARGET=$$($$($1_IMG_TGT_NAME)_MAKETGT) \
-		--tag $$(DOCKER_REGISTRY)/$$(DOCKER_IMAGE_PREFIX)/$1:$$(DOCKER_IMAGE_TAG) \
+		--tag $$(DOCKER_REGISTRY)/$$(DOCKER_IMAGE_PREFIX)/$$($$($1_IMG_TGT_NAME)_IMG_TITLE):$$($$($1_IMG_TGT_NAME)_IMG_TAG) \
 		$$(foreach tag,$$(DOCKER_IMAGE_EXTRA_TAGS),--tag $$(DOCKER_REGISTRY)/$$(DOCKER_IMAGE_PREFIX)/$1:$$(tag) )
 ifeq ($$(PUBLISH), true)
-	@docker push $$(DOCKER_REGISTRY)/$$(DOCKER_IMAGE_PREFIX)/$1:$$(DOCKER_IMAGE_TAG)
+	@docker push $$(DOCKER_REGISTRY)/$$(DOCKER_IMAGE_PREFIX)/$$($$($1_IMG_TGT_NAME)_IMG_TITLE):$$($$($1_IMG_TGT_NAME)_IMG_TAG)
 endif
 
 images: $$($1_IMG_TGT_NAME)
diff --git a/krm-functions/clusterctl-v0.3/Dockerfile b/krm-functions/clusterctl-v0.3/Dockerfile
new file mode 100755
index 000000000..f93d1aba5
--- /dev/null
+++ b/krm-functions/clusterctl-v0.3/Dockerfile
@@ -0,0 +1,16 @@
+ARG PLUGINS_BUILD_IMAGE=quay.io/airshipit/alpine:3.13.5
+
+FROM ${PLUGINS_BUILD_IMAGE} as ctls
+# Inject custom root certificate authorities if needed
+# Docker does not have a good conditional copy statement and requires that a source file exists
+# to complete the copy function without error.  Therefore the README.md file will be copied to
+# the image every time even if there are no .crt files.
+RUN apk update && apk add curl
+COPY ./certs/* /usr/local/share/ca-certificates/
+RUN update-ca-certificates
+ARG CCTL_VERSION=0.3.23
+RUN curl -L https://github.com/kubernetes-sigs/cluster-api/releases/download/v${CCTL_VERSION}/clusterctl-linux-amd64 -o /clusterctl
+RUN chmod +x /clusterctl
+
+FROM quay.io/airshipit/clusterctl:latest as release
+COPY --from=ctls /clusterctl /usr/local/bin/
diff --git a/krm-functions/clusterctl-v0.3/README.md b/krm-functions/clusterctl-v0.3/README.md
new file mode 100755
index 000000000..e6a679819
--- /dev/null
+++ b/krm-functions/clusterctl-v0.3/README.md
@@ -0,0 +1,6 @@
+# Clusterctl-v0.3
+
+This is a KRM function which invokes
+[clusterctl](https://github.com/kubernetes-sigs/cluster-api/tree/master/cmd/clusterctl)
+version v0.3.x with appropriate action and options. Please refer to main clusterctl KRM function for
+further documentation.
diff --git a/krm-functions/clusterctl-v0.3/certs/README.md b/krm-functions/clusterctl-v0.3/certs/README.md
new file mode 100755
index 000000000..7d04f7ec4
--- /dev/null
+++ b/krm-functions/clusterctl-v0.3/certs/README.md
@@ -0,0 +1,6 @@
+# Additional Docker image root certificate authorities
+If you require additional certificate authorities for your Docker image:
+* Add ASCII PEM encoded .crt files to this directory
+  * The files will be copied into your docker image at build time.
+
+To update manually copy the .crt files to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates.
\ No newline at end of file
diff --git a/krm-functions/clusterctl/Dockerfile b/krm-functions/clusterctl/Dockerfile
index da24dfa58..142d55f80 100644
--- a/krm-functions/clusterctl/Dockerfile
+++ b/krm-functions/clusterctl/Dockerfile
@@ -10,7 +10,7 @@ FROM ${PLUGINS_BUILD_IMAGE} as ctls
 RUN apk update && apk add curl
 COPY ./certs/* /usr/local/share/ca-certificates/
 RUN update-ca-certificates
-ARG CCTL_VERSION=0.3.22
+ARG CCTL_VERSION=0.3.23
 RUN curl -L https://github.com/kubernetes-sigs/cluster-api/releases/download/v${CCTL_VERSION}/clusterctl-linux-amd64 -o /clusterctl
 RUN chmod +x /clusterctl
 
diff --git a/manifests/site/docker-test-site/phases/clusterctl_image_patch.yaml b/manifests/site/docker-test-site/phases/clusterctl_image_patch.yaml
index 43023064e..98b697aa5 100644
--- a/manifests/site/docker-test-site/phases/clusterctl_image_patch.yaml
+++ b/manifests/site/docker-test-site/phases/clusterctl_image_patch.yaml
@@ -3,4 +3,4 @@ kind: GenericContainer
 metadata:
   name: clusterctl
 spec:
-  image: quay.io/airshipit/clusterctl:eb9ac97ce207542e1e4d3b363963bfc5f0847096
+  image: localhost/clusterctl:v0.3
diff --git a/tools/deployment/21_systemwide_executable.sh b/tools/deployment/21_systemwide_executable.sh
index 5eb1b1ac8..b2b2b36e7 100755
--- a/tools/deployment/21_systemwide_executable.sh
+++ b/tools/deployment/21_systemwide_executable.sh
@@ -51,6 +51,7 @@ fi
 export AIRSHIP_KRM_FUNCTION_REPO=${AIRSHIP_KRM_FUNCTION_REPO:-"quay.io/airshipit"}
 export AIRSHIP_KRM_FUNCTION_TAG=${AIRSHIP_KRM_FUNCTION_TAG:-"latest"}
 export SOPS_KRM_FUNCTION=${SOPS_KRM_FUNCTION:-"gcr.io/kpt-fn-contrib/sops:v0.3.0"}
+export CLUSTERCTL_V3_KRM_FUNCTION=${CLUSTERCTL_V3_KRM_FUNCTION:-"quay.io/airshipit/clusterctl:v0.3"}
 
 echo "Resolve krm function versions"
 
@@ -63,8 +64,12 @@ set_krm_function () {
 
 for FUNC in $(cd krm-functions; echo */ | tr -d /)
 do
+  if [[ "$FUNC" == "clusterctl-v0.3" ]]; then
+    continue
+  fi
   IMG="${AIRSHIP_KRM_FUNCTION_REPO}/${FUNC}:${AIRSHIP_KRM_FUNCTION_TAG}"
   set_krm_function "$FUNC" "$IMG"
 done
 
 set_krm_function "sops" "$SOPS_KRM_FUNCTION"
+set_krm_function "clusterctl:v0.3" "$CLUSTERCTL_V3_KRM_FUNCTION"